Security Advisories (4)
CVE-2026-61484 (2026-08-05)

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61483 (2026-08-05)

Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61485 (2026-08-05)

Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-61486 (2026-08-05)

Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NAME

LucyX::Index::LongFieldSim - Similarity optimized for long fields.

SYNOPSIS

package MySchema::body;
use base qw( Lucy::Plan::FullTextType );
use LucyX::Index::LongFieldSim;
sub make_similarity { LucyX::Index::LongFieldSim->new }

DESCRIPTION

Apache Lucy's default Similarity implmentation produces a bias towards extremely short fields.

Lucy::Index::Similarity

| more weight
| *
|  **  
|    ***
|       **********
|                 ********************
|                                     *******************************
| less weight                                                        ****
|------------------------------------------------------------------------
  fewer tokens                                              more tokens

LongFieldSim eliminates this bias.

LucyX::Index::LongFieldSim

| more weight
| 
|    
|    
|*****************
|                 ********************
|                                     *******************************
| less weight                                                        ****
|------------------------------------------------------------------------
  fewer tokens                                              more tokens

In most cases, the default bias towards short fields is desirable. For instance, say you have two documents:

  • "George Washington"

  • "George Washington Carver"

If a user searches for "george washington", we want the exact title match to appear first. Under the default Similarity implementation it will, because the "Carver" in "George Washington Carver" dilutes the impact of the other two tokens.

However, under LongFieldSim, the two titles will yield equal scores. That would be bad in this particular case, but it could be good in another.

"George Washington Carver is cool."

"George Washington Carver was born on the eve of the US Civil War, in
1864.  His exact date of birth is unknown... Carver's research in crop
rotation revolutionized agriculture..."

The first document is succinct, but useless. Unfortunately, the default similarity will assess it as extremely relevant to a query of "george washington carver". However, under LongFieldSim, the short-field bias is eliminated, and the addition of other mentions of Carver's name in the second document yield a higher score and a higher rank.